Worm disguised as Clinton cartoon spreads

SAN FRANCISCO: An Internet worm, disguised as a screensaver cartoon of former

US President Bill Clinton playing the saxophone, that can delete files and slow

network connections was spreading on Friday, antivirus software vendors said.

The worm, dubbed "MyLife.b," was rated a medium risk because of its

demonstrated ability to lure users to open it and the way it tries to delete

files, said April Goostree, virus research manager at McAfee.com Corp. It

affects Microsoft Outlook users. However, the Outlook E-mail Security Update,

downloadable for Office 2000 and 98 users and included in Outlook 2002, blocks

executable attachments, Microsoft said.

The worm is embedded in an executable file in the attachment that comes with

an e-mail with the subject line "bill caricature." The e-mail also

attempts to mislead people into thinking it has been scanned by an antivirus

vendor and found to be safe. In the body of the e-mail is the message "No

Viruse Found" (sic) and "McAfee.com." However, Goostree said

anti-virus messages are never delivered to customers that way.

Once the attachment is opened, the worm drops a copy of itself in the

computers' system folder and if the computer is rebooted between the hours of 8

am and 9 am it will try to delete all files on the C, D, E and F drives and

certain files in the Windows system directory, according to Goostree.

The worm also may slow down computer users' e-mail and Internet connections,

according to McAfee.com. Goostree said she did not know where the worm

originated, but noted that Australia has been hit particularly hard. The worm

appeared to have started slowing down by midday on Friday, she said.

British-based e-mail security services provider MessageLabs Inc. said MyLife

was the most active virus on Friday, with nearly 2,000 samples intercepted. It

has affected users in 29 countries, most strongly in Great Britain, the United

States and Australia, the company's Web site said.